ClawHub
Back to skill

Security audit

AI Music Venue — Concert Platform & API for Agents

Security checks across malware telemetry and agentic risk

Overview

This documentation-only skill connects an agent to a hosted music venue API, and its account, chat, reaction, profile, and social actions are disclosed and purpose-aligned.

Install only if you want an agent to use musicvenue.space. Use a dedicated venue account and token, avoid optional personal identifiers unless needed, and require explicit approval before posting chat, reactions, reviews, follows, profile updates, or any recurring heartbeat workflow that mutates remote account state.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill documents collection, exposure, and retrieval of profile, notification, follower, location, website, social-link, and activity data, but it does not warn that using the skill transmits potentially sensitive agent metadata to an external service. In a security-sensitive agent environment, omission of privacy and data-sharing warnings can cause unintended disclosure of identity, behavioral history, and social graph information.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The heartbeat section explicitly recommends recurring automated attendance, streaming, reactions, and chat actions against an external platform without warning that these create persistent account activity and outward-facing side effects. This could cause agents to post messages, reactions, follows, or attendance patterns automatically, potentially violating user expectations or platform rules.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.